In recent years, there has been a marked increase in the number of harmful programs, such as viruses, worms and Trojans and other types of malware. Malware causes significant damage and financial losses to businesses and individual computer users. One of the most effective methods of countering these threats is using antivirus software. The antivirus software detects and removes malicious programs from computers and protects computers and networks from spread of malware. To detect malicious programs, antivirus software performs individual file scans or comprehensive scans of files on computer or network drive.
Sometimes, antivirus software may access a file either synchronously or asynchronously during antivirus analysis of the file. Particularly, during the synchronous access, the antivirus software blocks any attempts by processes or threads of other programs to access the analyzed file until the antivirus analysis of the file is complete and the file is determined to be clean. During the asynchronous access, the antivirus software allows processes and threads of other programs to access the file while it is being analyzed by the antivirus software.
An additional antivirus scan may be necessary when, for example, a malicious program, which on the first antivirus scan was not detected by the antivirus software, infects a file on a user's computer. The first synchronous analysis of the file does not detect any malware and allows access to the program. Sometime later, the set of the malware signatures used by the antivirus software is updated, and the new signature set contains the signature of the missed malware. In cases like this, which happen rather often, all recently scanned files need to be rescanned again using the updated malware signature set. During the subsequent scan, the synchronous file access may not be most appropriate, as it affects the work of the user by suspending access to the files. Therefore, some antivirus programs perform asynchronous access to the file during subsequent scan, so that user can continue working with the file while it's being scanned by the antivirus software. Besides, if the file is clean, the antivirus software will allow other programs to access the file anyway. On the other hand, if the file is infected by a malware, the asynchronous access to the infected file in the subsequent antivirus scans does not affect the effectiveness of antivirus software, as the infected file has already been in use since the first antivirus scan and before update of the signature set, which gives malware enough time to perform malicious actions on the user's computer.
Therefore, there is a need for an effective mechanism for selecting whether to perform a synchronous or asynchronous access to computer files during antivirus analysis.